Headphones / Remote Control

The headphone jack is a standard 3.5mm stereo, but there is also a small 6 pin connector next to it for the "remote control" that is included in the Value Pack. If we assume the following pin numbering (socket in the PSP as viewed from the outside):
top row: 1,2,3  bottom row: 4,5,6
Then the pinout is as follows (tip/ring/sleeve refers to the three parts of the stereo jack):

PinInternal wireFunction
1Brown wireMicrophone input (decouple with a capacitor against audio ground)
2Blue wireDigital ground
3Orange wireTXD
4Green wireSense? Grounding this pin wakes PSP from standby.
5Yellow wire+2.5V
6Grey wireRXD
TipPink wireLeft audio
RingRed wireRight audio
SleeveBlack wireAudio ground

The PSP communicates with the microcontroller inside the remote control using RS232 serial communication (although the voltages are different of course, 0V and +2.5V) using 8N1 framing at 4800bps. The protocol consists of command packages which can be send by either the PSP or the remote control. A package is exchanged as follows:

0xF0 Request to transmit
0xF8Clearance to transmit
0xFD Packet starts
cmd Command code + phase
params ... Zero or more bytes of parameter data
checksum XOR of the cmd and params bytes
0xFE Packet ends
0xFA/0xFBPacket received correctly

If the packet is not received correctly, or the receiver is too busy to allow the packet to be transmitted, the corresponding 0xFA/0xFB/0xF8 is not sent, in which case the sender should wait a while (60 ms) and then try again from the 0xF0. If no answer is received in a long time (> 1s), a BREAK can be sent to reset the communication channel, after which the state should be the same as if the remote control had been disconnected and reconnected again.

The least significant bit of the cmd byte is the phase indicator, which is used to differentiate a new command from the retransmission of an old one. The first packet sent from a particular device has phase 0 (LSB = 0), and is acknowledged with 0xFA. Then the phase is inverted each time a new packets is sent. Packets with phase 1 are acknowledged with 0xFB. Phase is not shared, so when the PSP sends a packet it does not affect the phase of the remote control, and vice versa.

Note that there seems to be no particular way to know how many parameter bytes are contained in the message, as the parameter bytes or the checksum could contain an 0xFE as well. It is therefore necessary to know how many parameter bytes each command takes.

The command sent by the remote control to inform the PSP of what buttons are pressed is 0x84. It takes two parameter bytes, which if interpreted as a 16-bit integer (little endian) forms a bitfield like so:

20x0004Fast Forward
40x0010Vol +
50x0020Vol -

Buttons that are pressed have their corresponding bits set to 1. Buttons that are not pressed or do not exist have their corresponding bits set to 0.